Amazon agreed to pay a record $2.25 million civil penalty and submit to a court injunction to resolve allegations it repeatedly denied identity theft victims access to transaction records they were legally entitled to receive under federal law.<\/p>\n
The Justice Department filed the complaint in U.S. District Court for the District of Columbia on behalf of the Federal Trade Commission, alleging Amazon knowingly violated Section 609(e) of the Fair Credit Reporting Act, which requires businesses to provide identity theft victims with application and transaction records related to fraudulent activity made in their names within 30 days of a request.<\/p>\n
According to the FTC, Amazon customer service agents routinely told victims requesting those records that the company could not share them for \u201cprivacy\u201d or \u201csecurity\u201d reasons. The FTC said Amazon had no written policy for handling such requests until early 2025 \u2014 after it learned of the investigation \u2014 and that it even refused records to law enforcement agencies submitting requests on victims\u2019 behalf. When Amazon did provide records, it sometimes did so after the 30-day window required by law.<\/p>\n
The $2.25 million penalty is the largest ever imposed for a Section 609(e) FCRA violation, according to the FTC. It is the agency\u2019s second case brought under that provision, following a 2020 action against Kohl\u2019s Department Stores.<\/p>\n
\u201cConsumers whose identities have been stolen should not face unnecessary red tape when they investigate how their identities were misused and seek to clear their names,\u201d said Brett Shumate, assistant attorney general for the Justice Department\u2019s Civil Division.<\/p>\n
Under the court order, Amazon must provide qualifying transaction records to identity theft victims free of charge within 30 days of a verified request, post a notice on its website explaining how victims can request those records, and contact consumers who requested records since April 2024 but did not receive them to notify them that Amazon may have additional records available. Amazon is also permanently prohibited from further violations of the FCRA\u2019s identity theft records provisions.<\/p>\n